socketduct 0.1.26 → 0.1.27

package/changelog.d/20261025070000-reclaim-unreadable-retention-lock.md

@@ -0,0 +1,14 @@
+# Reclaim unreadable retention locks
+
+Retention now reclaims a `.socketduct-retention.lock` whose owner record this
+process cannot read instead of failing the whole run. A lock written by a
+privileged one-off process (a root repair or cleanup) is mode 0600 and owned by
+another uid, so every later retention attempt raised `EACCES` from
+`readOwnerFile`. That error propagated out of the durable log sink at startup and
+took down the server process that owns the sink.
+
+The lock directory is private and peer writers share this process's uid, so an
+unreadable record cannot belong to a live peer of the runtime. Retention now
+unlinks such a file and retries the atomic link. If the file cannot be removed,
+retention fails with `LOG_RETENTION_LOCK_UNREADABLE`, which names the lock path
+and the owning uid instead of surfacing a bare `EACCES`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "socketduct",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "description": "Resilient authenticated tunnel/proxy for keeping socket streams alive across flaky links.",
   "type": "module",
   "main": "./src/index.js",

package/src/logging/log-retention.js

@@ -94,7 +94,20 @@ async function acquireRetentionLock(directory, lockPath) {
   for (let attempt = 0; attempt < 3; attempt += 1) {
     const created = await createOwnerFile(directory, lockPath, owner)
     if (created !== undefined) return created
-    const existing = await readOwnerFile(lockPath)
+    let existing
+    try {
+      existing = await readOwnerFile(lockPath)
+    } catch (error) {
+      // A lock this process cannot read cannot belong to a live peer: peers write
+      // their owner record mode 0600 under their own uid into this private
+      // directory. Such a file is left behind by a privileged one-off process
+      // (a root-run repair or cleanup), and because its record is unreadable here
+      // it would block retention for every later run - failing the durable log
+      // sink and, with it, the server process that owns the sink.
+      if (!isCode(error, "EACCES") && !isCode(error, "EPERM")) throw error
+      await reclaimUnreadableLock(directory, lockPath)
+      continue
+    }
     if (existing === undefined) continue
     if (await ownerIsLive(existing.owner)) return undefined
     const current = await lstat(lockPath).catch((error) => { if (isCode(error, "ENOENT")) return undefined; throw error })
@@ -106,6 +119,28 @@ async function acquireRetentionLock(directory, lockPath) {
   return undefined
 }
 
+/**
+ * Removes a retention lock that this process cannot read, so the caller can retry
+ * the atomic link. Unlink is attempted rather than deferred: the directory is
+ * private, and a lock whose owner record is unreadable here cannot be held by a
+ * peer of this runtime.
+ * @param {string} directory - Private log directory.
+ * @param {string} lockPath - Unreadable lock path.
+ */
+async function reclaimUnreadableLock(directory, lockPath) {
+  const stats = await lstat(lockPath).catch((error) => { if (isCode(error, "ENOENT")) return undefined; throw error })
+  if (stats === undefined) return
+  if (!stats.isFile()) throw Object.assign(new Error("Unsafe retention lock"), {code: "LOG_RETENTION_LOCK_INVALID"})
+  await unlink(lockPath).catch((error) => {
+    if (isCode(error, "ENOENT")) return
+    throw Object.assign(
+      new Error(`Retention lock ${lockPath} is owned by uid ${stats.uid} and cannot be reclaimed by uid ${process.getuid?.()}: ${error instanceof Error ? error.message : String(error)}`),
+      {cause: error, code: "LOG_RETENTION_LOCK_UNREADABLE"}
+    )
+  })
+  await syncDirectory(directory)
+}
+
 /**
  * @param {string} directory - Directory.
  * @param {string} lockPath - Destination.

package/test/unit/logging/log-retention.test.js

@@ -1,6 +1,6 @@
 /* eslint-disable jsdoc/escape-inline-tags, jsdoc/require-param-type, jsdoc/require-returns */
 import {describe, expect, it, withTestCleanup} from "@velocious/testing"
-import {readlinkSync} from "node:fs"
+import {chmodSync, chownSync, readlinkSync} from "node:fs"
 import {mkdtemp, readFile, readdir, rm, utimes, writeFile} from "node:fs/promises"
 import {tmpdir} from "node:os"
 import {join} from "node:path"
@@ -63,6 +63,24 @@ describe("log retention", () => {
     await writeFile(lockPath, `${JSON.stringify({version: 1, pid: process.pid, processStart, tid, threadStart})}\n`, {mode: 0o600})
     expect((await enforceLogRetention({directory, maxAgeMs: 60_000, maxBytes: 1024})).skipped).toBe(true)
   }))
+
+  it("retention reclaims a lock left behind by a privileged process it cannot read", async () => withTestCleanup(async (after) => {
+    const directory = await mkdtemp(join(tmpdir(), "socketduct-retention-foreign-"))
+    after(() => rm(directory, {recursive: true, force: true}))
+    const lockPath = join(directory, ".socketduct-retention.lock")
+    const uid = typeof process.getuid === "function" ? process.getuid() : undefined
+
+    await writeFile(lockPath, `${JSON.stringify({version: 1, pid: 1, processStart: "1", tid: 1, threadStart: "1"})}\n`, {mode: 0o600})
+
+    if (uid === 0) chownSync(lockPath, 65_534, 65_534)
+    else if (uid !== undefined) chmodSync(lockPath, 0o000)
+
+    // The lock owner record is unreadable for this process, so retention cannot
+    // wait for it: it must reclaim the file and complete instead of failing the
+    // durable log sink for the whole server process.
+    expect((await enforceLogRetention({directory, maxAgeMs: 60_000, maxBytes: 1024})).skipped).toBe(false)
+    expect((await readdir(directory)).includes(".socketduct-retention.lock")).toBe(false)
+  }))
 })
 
 /**